There is no documentation needed during a call centre either. They will ask if said person (who is on the booking) has authority to act on behalf of the other person and will ask them to be able to identify them with a few details. I have made hundreds of changes now for myself and partner on the same bookings and thats the norm.
All passengers have access to their own booking details regardless of who booked or paid for the flight. This is neither new nor a strange thing. In fact, the majority of people prefer it in this manner so that you can make adjustments or fill out details when you're not the one that made the booking for a variety of legitimate reasons (seat selection, meal selection, passenger detail, last minute changes etc). You nominate a primary point of contact, however they are not the only person with authorisation.
Unfortunately Qantas at that point doesn't need to contact you again nor do they know of your situation as "someone with authority to act" has decided to cancel the ticket.
The other thing of note here is that you're accusing Qantas of misconduct and if you had gone into the call demanding resolution to a "security breech", regardless of how the situation is the person on the other end will be highly defensive and unwilling to cooperate very much. This is a fraud situation rather than a security breech, however also note that at this point in time QF has been massively dragged through negative press for the actual cybersecurity breech and call centre staff would have been told how to respond to terms like "security breech".
If you had framed it in a manner such that your partner has acted fraudulently, without your authorisation and explained the situation with documentation from your end, you may find that they may have a different reaction and response.
Ultimately, I'm sorry that this has happened to you and that it would be an extremely stressful time overall. I do hope that you can get a positive resolution from this overall.